feat: 埋点采集模块落地——AnalyticsService + 登录/注册/退出三事件（M0 简化版，报告 13）

- AnalyticsService：trackEvent(name, props?)/identify(userId)/reset()；隐私红线本地校验（password/token/phone 等模式拒绝）；匿名 ID 持久化复用 session deviceId；sessionId 简化为每事件生成（M0）；网络失败静默丢弃（无重试，按规范）
- 登录/注册成功挂接 auth_login_succeeded / auth_register_succeeded（durationMs）；失败挂接 _failed（failureReason）；退出挂接 auth_logout
- TODO（工单允许部分挂接）：page_viewed（登录/注册/首页/个人中心各一次，M0 无路由埋点基础）；health_record_action（M2 档案实现后挂接）；auth_session_restore_*（Splash 恢复流程待完善）；队列持久化到 shared_preferences 分段（当前内存队列 max 500，满 20 触发上传）
- 测试：flutter test → 34 passed（30→34，新增 analytics_service_test 4 例：字段/隐私拒绝/identify/reset）；flutter analyze → 86 issues（与上一波同源）；dart format → 1 changed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/features/auth/auth_repository.dart

@@ -1,3 +1,4 @@
+import 'package:patbond_flutter/analytics/analytics_service.dart';
 import 'package:patbond_flutter/core/network/api_client.dart';
 import 'package:patbond_flutter/core/network/api_exception.dart';
 import 'package:patbond_flutter/core/network/token_refresher.dart';
@@ -34,12 +35,14 @@ class ApiAuthRepository implements AuthRepository {
     required this._api,
     required this._session,
     required this._refresher,
+    AnalyticsService? analytics,
     this._uuid = const Uuid(),
-  });
+  }) : _analytics = analytics;
 
   final ApiClient _api;
   final SessionManager _session;
   final TokenRefresher _refresher;
+  final AnalyticsService? _analytics;
   final Uuid _uuid;
 
   @override
@@ -47,13 +50,27 @@ class ApiAuthRepository implements AuthRepository {
     required String username,
     required String password,
   }) async {
-    final data = await _api.request(
-      '/api/v1/auth/login',
-      body: {'username': username, 'password': password},
-    );
-    await _session.saveSession(
-      AuthTokens.fromJson(data! as Map<String, dynamic>),
-    );
+    final startTime = DateTime.now();
+    try {
+      final data = await _api.request(
+        '/api/v1/auth/login',
+        body: {'username': username, 'password': password},
+      );
+      await _session.saveSession(
+        AuthTokens.fromJson(data! as Map<String, dynamic>),
+      );
+      _analytics?.identify(_session.userId!);
+      _analytics?.trackEvent('auth_login_succeeded', {
+        'identifierType': 'username',
+        'durationMs': DateTime.now().difference(startTime).inMilliseconds,
+      });
+    } catch (error) {
+      _analytics?.trackEvent('auth_login_failed', {
+        'identifierType': 'username',
+        'failureReason': error.toString(),
+      });
+      rethrow;
+    }
   }
 
   @override
@@ -62,15 +79,27 @@ class ApiAuthRepository implements AuthRepository {
     required String phone,
     required String password,
   }) async {
-    final data = await _api.request(
-      '/api/v1/auth/register',
-      body: {'username': username, 'phone': phone, 'password': password},
-      // 每次提交一个幂等键；token 刷新后的自动重放沿用同一个键。
-      headers: {'Idempotency-Key': _uuid.v4()},
-    );
-    await _session.saveSession(
-      AuthTokens.fromJson(data! as Map<String, dynamic>),
-    );
+    final startTime = DateTime.now();
+    try {
+      final data = await _api.request(
+        '/api/v1/auth/register',
+        body: {'username': username, 'phone': phone, 'password': password},
+        // 每次提交一个幂等键；token 刷新后的自动重放沿用同一个键。
+        headers: {'Idempotency-Key': _uuid.v4()},
+      );
+      await _session.saveSession(
+        AuthTokens.fromJson(data! as Map<String, dynamic>),
+      );
+      _analytics?.identify(_session.userId!);
+      _analytics?.trackEvent('auth_register_succeeded', {
+        'durationMs': DateTime.now().difference(startTime).inMilliseconds,
+      });
+    } catch (error) {
+      _analytics?.trackEvent('auth_register_failed', {
+        'failureReason': error.toString(),
+      });
+      rethrow;
+    }
   }
 
   @override
@@ -86,6 +115,8 @@ class ApiAuthRepository implements AuthRepository {
       // 服务端撤销失败不阻塞本地登出；refresh 侧最终会自然过期。
     } finally {
       await _session.clearSession();
+      _analytics?.reset();
+      _analytics?.trackEvent('auth_logout', {'serverRevoked': true});
     }
   }